CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 4652 | CVE-2002-0260 | Candidate | Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, which is not properly handled by the logging utility. | Proposed (20020502) | ACCEPT(3) Armstrong, Cole, Frech | NOOP(3) Cox, Foat, Wall | View | |
| 4653 | CVE-2002-0261 | Candidate | Directory traversal vulnerability in InstantServers MiniPortal 1.1.5 and earlier allows remote authenticated users to read arbitrary files via a ... (modified dot dot) in the GET command. | Proposed (20020502) | ACCEPT(3) Armstrong, Cole, Frech | NOOP(3) Cox, Foat, Wall | View | |
| 4658 | CVE-2002-0266 | Candidate | Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an error message that includes the full pathname. | Proposed (20020502) | ACCEPT(3) Armstrong, Cole, Frech | NOOP(3) Cox, Foat, Wall | View | |
| 5935 | CVE-2002-1551 | Candidate | Buffer overflow in nslookup in IBM AIX may allow attackers to cause a denial of service or execute arbitrary code. | Proposed (20030317) | ACCEPT(3) Armstrong, Cole, Green | MODIFY(1) Bollinger | NOOP(1) Cox | REVIEWING(1) Christey | Bollinger> IY34670 did not have a complete fix for this vulnerability. | The complete fix is found in IY40519. In addition, nslookup | completely drops privileges very early in the process. This buffer | overflow would not result in privilege increase. | Christey> If this overflow doesn"t cross privilege boundaries, then it"s | not security relevant and should be excluded from CVE. | View |
| 5669 | CVE-2002-1285 | Candidate | runlpr in the LPRng package allows the local lp user to gain root privileges via certain command line arguments. | Proposed (20030317) | ACCEPT(3) Armstrong, Cole, Green | MODIFY(1) Cox | CHANGE> [Cox changed vote from REVIEWING to MODIFY] | Cox> LPRng does not contain anything called runlpr, and in fact if you | look at the packages SuSE say that they ship as part of the erratum they | don"t even provide updated LPRng packages. However they do ship lprfilter | packages and looking inside them I find that they are what contain this | runlpr program: | | http://at.rpmfind.net/opsys/linux/RPM/suse.com/i386/update/8.0/ap1/lpdfilter-0.42-155.i386.html | | This states that lpdfilter is a collection of scripts written by SuSE, and | the changelog even highlights this is where the security fix was made. | Therefore I believe that the CVE reference and all the descriptions of | this vulnerability, which are based on a bad advisory description from | SuSE, are also wrong, it should be: | | "runlpr from the SuSE lpdfilter package allows the local lp user to gain | root privileges via certain command line arguments." | View |
Page 909 of 20943, showing 5 records out of 104715 total, starting on record 4541, ending on 4545
